CloudTrail is not enabled

Severity: Low
Service: CloudTrail
Check ID: CLOUDTRAIL_OFF

What this check finds

CloudTrail provides audit logs for an account and should be enabled. Preferably, this should be done at the Organization level.

Passing looks like: CloudTrail enabled.

How to fix it

Create a multi-region CloudTrail trail with log file validation enabled.

AWS CLI

aws cloudtrail create-trail --name org-trail --s3-bucket-name YOUR_BUCKET --is-multi-region-trail --enable-log-file-validation && aws cloudtrail start-logging --name org-trail

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to CloudTrail is not enabled
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	3.1 Ensure CloudTrail is enabled in all regions
PCI-DSS v4.0.1	10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity
HIPAA Security Rule	164.312(b) Implement hardware, software, and procedural mechanisms to record activity
SOC 2 — Trust Services Criteria	CC7.2 Security Event Monitoring
NIST SP 800-53 Rev5 (Moderate)	AU-2 Event Logging AU-12 Audit Record Generation
NIST Cybersecurity Framework 2.0	PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.8.15 Logging A.8.32 Change management

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More CloudTrail checks

All CloudTrail checks